JP2023168681A - On-vehicle device, control method and computer program - Google Patents

Abstract

To detect unauthorized intrusion more reliably.SOLUTION: An on-vehicle device connected to an ECU equipped on a vehicle with a communication line includes: a PHY part for converting a reception signal received from the communication line to a digital signal; an oscillation circuit for outputting a first oscillation signal based on oscillation of a first oscillator; a detection circuit for outputting a detection value according to the difference between the frequency of the first oscillation signal and the frequency of a second oscillation signal included in the reception signal; a switch part for switching between a first state in which at least a part of signal in the reception signal is not inputted to the PHY part and a second state in which the reception signal is inputted to the PHY part; and a control part for controlling the switch part, the control part makes the switch part to the first state if the detection value represent a difference exceeding a predetermined value from a normal value according to the difference between the frequency of the first oscillation signal and the frequency of a third oscillation signal generated based on the oscillation of a second oscillator included in the ECU, and makes the switch part to the second state if the detection value is within the predetermined value from the normal value.SELECTED DRAWING: Figure 3

Description

The present disclosure relates to an in-vehicle device, a control method, and a computer program.

2. Description of the Related Art Techniques for preventing unauthorized intrusion into an in-vehicle network including an ECU (Electronic Control Unit) etc. installed in a vehicle are known. For example, in Patent Document 1, a CPU included in an ECU monitors a terminal connected to a port. If the MAC address of the connected terminal is different from the destination MAC address of the terminal registered in advance in the MAC address table, the port is disabled, thereby preventing unauthorized intrusion into the in-vehicle LAN.

JP2019-125991A

In recent years, unauthorized terminals have been able to eavesdrop on data sent and received between multiple ECUs in the in-vehicle network, record normal sequences on the unauthorized terminal, and then impersonate one of the ECUs and illegally infiltrate the in-vehicle network. There is a method.

In this case, since the unauthorized terminal copies the MAC address of the ECU included in the in-vehicle network, conventional monitoring methods such as those disclosed in Patent Document 1 cannot detect unauthorized intrusion.

In view of such problems, an object of the present disclosure is to provide an in-vehicle device, a control method, and a computer program that can more reliably detect unauthorized intrusion.

An in-vehicle device of the present disclosure is an in-vehicle device that is connected to an ECU mounted on a vehicle through a communication line, and includes a PHY unit that converts a reception signal received from the communication line into a digital signal, and a first oscillator. an oscillation circuit that outputs a first oscillation signal based on oscillation; and a detection circuit that outputs a detected value according to a difference between the frequency of the first oscillation signal and the frequency of a second oscillation signal included in the received signal. a switch unit for switching between a first state in which at least some of the received signals are not input to the PHY unit and a second state in which the received signals are input to the PHY unit; and a switch unit for controlling the switch unit. and a control unit, wherein the detected value is the frequency of the first oscillation signal and the frequency of a third oscillation signal generated based on oscillation of a second oscillator included in the ECU. , when the detected value is different from the normal value by more than a predetermined value according to the difference, the switch section is set to the first state, and when the detected value is within the predetermined value from the normal value, the switch section is set to the first state. The vehicle-mounted device is configured to set the second state to the second state.

The control method of the present disclosure is a control method for controlling an in-vehicle device connected to an ECU mounted on a vehicle through a communication line, and when a detected value differs from a normal value by more than a predetermined value, a first step of setting a first state in which at least some of the received signals received from the communication line are not input to the PHY unit; a second step of inputting the received signal into the PHY unit into a second state; the PHY unit converts the received signal into a digital signal; and the detected value is transmitted to an oscillation circuit included in the vehicle-mounted device. is a value corresponding to the difference between the frequency of the first oscillation signal output based on the oscillation of the first oscillator and the frequency of the second oscillation signal included in the received signal, and the normal value is In this control method, the value corresponds to the difference between the frequency of an oscillation signal and the frequency of a third oscillation signal generated based on oscillation of a second oscillator included in the ECU.

A computer program of the present disclosure is a computer program for controlling an on-vehicle device connected to an ECU mounted on a vehicle through a communication line, and the computer program causes the computer to detect a detected value from a normal value to a predetermined value. a first step of setting a first state in which at least part of the received signals received from the communication line is not input to the PHY unit if the detected value is different from the normal value; If the value is within a predetermined value, the PHY unit converts the received signal into a digital signal and inputs the received signal into the PHY unit. is a value corresponding to the difference between the frequency of a first oscillation signal output by an oscillation circuit included in the in-vehicle device based on oscillation of a first oscillator and the frequency of a second oscillation signal included in the received signal. and the normal value is a value corresponding to a difference between the frequency of the first oscillation signal and the frequency of a third oscillation signal generated based on oscillation of a second oscillator included in the ECU. It is a program.

According to the present disclosure, unauthorized intrusion can be detected more reliably.

FIG. 1 is a diagram illustrating a configuration example of an in-vehicle system according to an embodiment. FIG. 2 is a diagram showing how the in-vehicle system shown in FIG. 1 has been illegally invaded. FIG. 3 is a diagram illustrating a configuration example of the in-vehicle device according to the embodiment. FIG. 4 is a flowchart illustrating the detection method according to the embodiment. FIG. 5 is a flowchart illustrating the detection method according to the embodiment. FIG. 6 is a graph illustrating detected values according to the embodiment. FIG. 7 is a graph illustrating the temperature characteristics of the oscillator. FIG. 8 is a table illustrating the relationship between normal values and temperature according to a modification. FIG. 9 is a graph illustrating aging characteristics of an oscillator. FIG. 10 is a diagram showing the configuration of an in-vehicle system according to a modification. FIG. 11 is a graph illustrating detected values according to a modified example.

[Description of embodiments of the present disclosure]
The embodiment of the present disclosure includes the following configuration as its gist.

(1) The in-vehicle device of the present disclosure is an in-vehicle device that is connected to an ECU installed in a vehicle via a communication line, and includes a PHY unit that converts a reception signal received from the communication line into a digital signal, and a PHY unit that converts a reception signal received from the communication line into a digital signal. an oscillation circuit that outputs a first oscillation signal based on oscillation of a first oscillator, and outputs a detected value according to a difference between the frequency of the first oscillation signal and the frequency of a second oscillation signal included in the received signal. a detection circuit for switching between a first state in which at least part of the received signal is not input to the PHY unit and a second state in which the received signal is input to the PHY unit; a third oscillation signal generated based on the frequency of the first oscillation signal and oscillation of a second oscillator included in the ECU; When the frequency differs by more than a predetermined value from a normal value according to the difference between The in-vehicle device sets the switch section to the second state.

An unauthorized terminal or the like may be able to imitate the communication sequence of the ECU, but cannot imitate the third oscillation signal caused by the second oscillator of the ECU. Therefore, by determining whether the frequency of the second oscillation signal received from the communication line corresponds to the frequency of the third oscillation signal, unauthorized intrusion can be detected more reliably.

(2) In the in-vehicle device of (1) above, the detection circuit receives the first oscillation signal and the second oscillation signal, and the detection circuit has a frequency difference between the frequency of the first oscillation signal and the frequency of the second oscillation signal. The device may include a first circuit that detects a difference, and a second circuit that converts the difference detected by the first circuit into the detected value.

With this configuration, the difference between the frequency of the first oscillation signal and the frequency of the second oscillation signal can be converted into a detected value.

(3) In the vehicle-mounted device of (2) above, the received signal may be a signal in which the second oscillation signal and the data signal are superimposed. In this case, the detection circuit may further include an extraction circuit that extracts the second oscillation signal from the received signal and outputs it to the first circuit.

With this configuration, the second oscillation signal can be extracted from the received signal.

(4) The in-vehicle device according to any one of (1) to (3) above may further include a storage section in which the normal value is stored in advance.

(5) In the vehicle-mounted device according to (4) above, the control unit is capable of selecting a plurality of operation modes including a first mode and a second mode, and when the first mode is selected, the control unit The unit changes the normal value stored in the storage unit to the detected value output from the detection circuit while the first mode is selected, and the second mode is selected. In this case, the control unit does not need to change the normal value stored in the storage unit.

With this configuration, it is possible to compensate for the frequency deviation of the oscillator due to aging, so that unauthorized intrusion can be detected more reliably.

(6) In the in-vehicle device according to (4) or (5) above, the control unit may control the A normal value may be determined.

With this configuration, it is possible to compensate for the frequency deviation of the oscillator caused by temperature changes, so that unauthorized intrusion can be detected more reliably.

(7) In the in-vehicle device according to any one of (1) to (6) above, the control unit controls a temperature adjustment unit that adjusts the temperature of the second oscillator, and the detection circuit controls the temperature of the first oscillator. according to the difference between the frequency of the signal and the frequency of the second oscillation signal included in the received signal received while the second oscillator is being adjusted to the first predetermined temperature by the temperature adjustment section. The first detection value, which is the detection value, is output to the control unit, and the control unit is configured to output the first detection value to the frequency of the first oscillation signal and the second oscillator by the temperature adjustment unit. and the frequency of the third oscillation signal generated based on the oscillation of the second oscillator while the temperature is being adjusted to the first predetermined temperature. If the difference exceeds a predetermined value, the switch section may be placed in the first state.

According to such a configuration, unauthorized intrusion is detected when the first detection value does not follow the temperature adjustment by the temperature adjustment section, and when the first detection value follows the temperature adjustment by the temperature adjustment section. Unauthorized intrusion is not detected. Thereby, even if the frequency of the second oscillator and the frequency of the third oscillator coincidentally match at a certain temperature, unauthorized intrusion can be detected.

(8) The control method of the present disclosure is a control method for controlling an on-vehicle device connected to an ECU mounted on a vehicle through a communication line, and when the detected value differs from a normal value by more than a predetermined value. a first step of setting a first state in which at least part of the received signals received from the communication line is not input to the PHY unit; and when the detected value is within the predetermined value from the normal value. and a second step of inputting the received signal into the PHY unit into a second state, wherein the PHY unit converts the received signal into a digital signal, and the detected value is included in the on-vehicle device. The normal value is a value corresponding to the difference between the frequency of the first oscillation signal outputted by the oscillation circuit based on the oscillation of the first oscillator and the frequency of the second oscillation signal included in the received signal, and the normal value is In this control method, the value corresponds to a difference between the frequency of the first oscillation signal and the frequency of a third oscillation signal generated based on oscillation of a second oscillator included in the ECU.

An unauthorized terminal or the like may be able to imitate the communication sequence of the ECU, but cannot imitate the third oscillation signal caused by the second oscillator of the ECU. Therefore, by determining whether the frequency of the second oscillation signal received from the communication line corresponds to the frequency of the third oscillation signal, unauthorized intrusion can be detected more reliably. Furthermore, since the received signal is input to the PHY unit only when no unauthorized intrusion is detected, it is possible to prevent unauthorized received signals from being input to the PHY unit.

(9) The computer program of the present disclosure is a computer program for controlling an in-vehicle device connected to an ECU installed in a vehicle through a communication line, and the computer program causes the computer to detect a detected value as a normal value. a first step of setting a first state in which at least part of the received signals received from the communication line is not input to the PHY unit when the detected value differs by more than a predetermined value; If the value is within the predetermined value, the received signal is input to the PHY unit in a second state, and the PHY unit converts the received signal into a digital signal; The detected value is based on the difference between the frequency of a first oscillation signal output by an oscillation circuit included in the in-vehicle device based on oscillation of a first oscillator and the frequency of a second oscillation signal included in the received signal. The normal value is a value corresponding to the difference between the frequency of the first oscillation signal and the frequency of a third oscillation signal generated based on oscillation of a second oscillator included in the ECU. It's a computer program.

An unauthorized terminal or the like may be able to imitate the communication sequence of the ECU, but cannot imitate the third oscillation signal caused by the second oscillator of the ECU. Therefore, by determining whether the frequency of the second oscillation signal received from the communication line corresponds to the frequency of the third oscillation signal, unauthorized intrusion can be detected more reliably. Furthermore, since the received signal is input to the PHY unit only when no unauthorized intrusion is detected, it is possible to prevent unauthorized received signals from being input to the PHY unit.

[1. Details of embodiments of the present disclosure]
Hereinafter, details of embodiments of the present disclosure will be described with reference to the drawings.

[1.1 Configuration of in-vehicle system 1]
FIG. 1 is a diagram showing a configuration example of an in-vehicle system 1 according to an embodiment.

The in-vehicle system 1 is a system installed in a vehicle 9 such as an automobile. The in-vehicle system 1 includes an in-vehicle device 10, a plurality of ECUs (Electronic Control Units) 20, and a plurality of communication lines 30 that connect the in-vehicle device 10 and the plurality of ECUs 20, respectively. The in-vehicle device 10 and the plurality of ECUs 20 are connected to each other via a plurality of communication lines 30, thereby forming an in-vehicle network.

The in-vehicle device 10 is, for example, a relay device that relays data transmitted and received between a plurality of ECUs 20. Specifically, the in-vehicle device 10 is a relay device that functions as an Ethernet switch (Ethernet is a registered trademark) and an L2 switch. Note that the in-vehicle device 10 may be an integrated ECU that manages control of a plurality of ECUs 20, or may be an ECU similar to the plurality of ECUs 20.

The number of ECUs 20 included in the in-vehicle system 1 is not particularly limited, and may be one. In the example of FIG. 1, the in-vehicle system 1 includes four ECUs 20. When distinguishing the four ECUs 20, they are referred to as ECUs 21, 22, 23, and 24, respectively.

The ECU 20 is, for example, a device (operation system ECU) that controls each part of the vehicle 9 (for example, a braking device, a door, a battery, an air conditioner, etc.). The functions of the ECU 20 are not particularly limited, and the ECU 20 may be a device (a cognitive ECU) that monitors the state of each part of the vehicle 9 by communicating with a sensor. The plurality of ECUs 20 may each have different functions, or may each have the same function.

A plurality of (four in the example of FIG. 1) communication lines 30 each extend from the in-vehicle device 10. When distinguishing between the four communication lines 30, the line extending to the ECU 21 is referred to as the communication line 31, the line extending to the ECU 22 is referred to as the communication line 32, the line extending to the ECU 23 is referred to as the communication line 33, and the line extending to the ECU 24 is referred to as the communication line 32. It is called line 34.

When the in-vehicle network is a network based on the Ethernet standard, the communication line 30 is a communication line based on the 1000BASE-T1 or 1000BASE-RH standard, for example. Note that the communication line 30 may comply with other standards such as CAN (Controller Area Network).

[1.2 Problems to be solved by the embodiment]
FIG. 2 is a diagram showing how the in-vehicle system 1 is being illegally invaded. First, the intruder inserts the hub H1 to which the unauthorized terminal D1 is connected in the middle of the communication line 31. The unauthorized terminal D1 is, for example, a personal computer such as a laptop computer, or a tablet terminal. The hub H1 is, for example, a repeater hub that copies data flowing through the communication line 31. For example, an intruder cuts the communication line 31, attaches a connector to each cut portion, and connects the hub H1 to the connector. Alternatively, the communication line 31 may be pulled out from one of the vehicle-mounted device 10 and the ECU 21 and inserted into the hub H1, and a new communication line may be connected from the hub H1 to the other of the vehicle-mounted device 10 and the ECU 21.

Subsequently, the intruder copies the data flowing through the communication line 31 to the unauthorized terminal D1 connected to the hub H1. The unauthorized terminal D1 then analyzes, for example, the MAC (Media Access Control) address of the ECU 21 and the communication sequence between the ECU 21 and the vehicle-mounted device 10 based on the data. Thereafter, the unauthorized terminal D1 impersonates the ECU 21 by copying the MAC address and communication sequence of the ECU 21 and transmits unauthorized data to the in-vehicle device 10.

For example, in the case of Patent Document 1, it is determined whether the communication partner is normal or unauthorized based on the MAC address. In the above-mentioned intrusion method, the MAC address of the ECU 21 is copied and the unauthorized intrusion is carried out, so a software monitoring method such as that disclosed in Patent Document 1 cannot detect the unauthorized intrusion.

Therefore, in this embodiment, unauthorized intrusion is detected by focusing on the frequency of an oscillator (for example, a crystal resonator) included in the ECU 20. Each of the plurality of ECUs 20 is provided with an oscillator to generate an oscillation signal (clock signal). For example, the ECU 21 includes a second oscillator 71. There are individual differences (tolerances) in the frequency of oscillators, and even if the oscillators have the same specifications, there will be a difference in frequency of, for example, about ±20 to 50 ppm. For this reason, conventionally, clocks have been synchronized on the signal receiving side to eliminate this frequency difference.

As shown in FIG. 1, in a normal state (a state without unauthorized access), the in-vehicle device 10 generates an oscillation signal SG3 (“third oscillation signal).

On the other hand, as shown in FIG. 2, when the unauthorized terminal D1 impersonates the ECU 21 and transmits data to the in-vehicle device 10, the in-vehicle device 10 transmits the oscillation generated based on the oscillation of the third oscillator H2 included in the hub H1. Receive signal SGx.

Although the unauthorized terminal D1 is able to impersonate the ECU 21 with respect to data contents such as the MAC address and communication sequence, the frequency of the oscillation signal SGx sent to the on-vehicle device 10 depends on the characteristics of the third oscillator H2. It is not possible to imitate the frequency of the oscillation signal SG3 transmitted from the oscillation signal SG3.

As a result of intensive research, the inventor found that the frequency of the oscillation signal received by the in-vehicle device 10 is the same as that of the oscillation signal of the ECU 21, taking advantage of the fact that the unauthorized terminal D1 cannot imitate signals caused by the hardware configuration of an oscillator, etc. We have come up with an invention that more reliably detects unauthorized intrusion by determining whether the frequency corresponds to SG3. The specific configuration will be explained below.

[1.3 Configuration of in-vehicle device 10]
FIG. 3 is a diagram illustrating a configuration example of the in-vehicle device 10 according to the embodiment.
The in-vehicle device 10 includes a plurality of PHY sections 11 , a processing device 12 , a switch section 13 , a detection circuit 14 , a control section 15 , a storage section 16 , a reading section 17 , a first oscillator 18 , and a temperature sensor 19 and.

The PHY unit 11 is an area that operates in a physical layer in the OSI (Open System Interconnection) reference model, and is, for example, an integrated circuit such as an Ethernet PHY. The PHY section 11 has a function of converting an analog signal (received signal RS1) received from the communication line 30 into a digital signal DS1 that can be recognized by the processing device 12 and outputting it to the processing device 12, and a function of converting the analog signal (received signal RS1) received from the communication line 30 to a digital signal DS1 that is input from the processing device 12. It has a function of converting the digital signal DS1 into an analog signal that can be recognized by the ECU 20 and transmitting it to the communication line 30.

The in-vehicle device 10 is provided with four PHY sections 11 corresponding to the number of ECUs 20.
Note that the number of PHY units 11 is not particularly limited, and for example, five or more may be provided. The four PHY units 11 each have the same internal configuration and are connected to four communication lines 31, 32, 33, and 34, respectively.

Among the four PHY units 11, the PHY unit 11 that converts an analog signal received from the communication line 31 into a digital signal DS1 is referred to as a "PHY unit 11a" to distinguish it. The PHY section 11a is connected to a second port 13b of the switch section 13, which will be described later.

The processing device 12 is a device that performs various types of processing based on the digital signal DS1 converted by the PHY section 11, and is, for example, a microcontroller unit (MCU). The processing device 12 may be a PLD (Programmable Logic Device) such as a CPLD (Complex PLD) or an FPGA (Field Programmable Gate Array). The processing device 12 issues control commands to the ECU 20 and analyzes the state of the ECU 20 based on the digital signal DS1, for example.

The switch unit 13 is, for example, a semiconductor switch, specifically a switch including a MOSFET (Metal-Oxide-Semiconductor Field-Effect-Transistor). Note that the switch section 13 may be a mechanical switch including a coil and a contact. The switch section 13 switches between a first state (the state shown by the solid line in FIG. 3) and a second state (the state shown by the imaginary line in FIG. 3) based on a control command from the control section 15.

The first state is a state in which at least part of the received signal RS1 received from the communication line 31 is not input to the PHY unit 11a. The second state is a state in which the reception signal RS1 received from the communication line 31 is input to the PHY section 11a. Specifically, the switch section 13 includes a first port 13a electrically connected to the detection circuit 14 and a second port 13b electrically connected to the PHY section 11a. For example, in the first state, the switch unit 13 electrically connects the communication line 31 to the first port 13a, thereby outputting all the reception signals RS1 received from the communication line 31 to the detection circuit 14, and The received signal RS1 is not input to 11a.

Note that, in the first state, the switch unit 13 may divide the received signal RS1, for example, temporally, output a part of the signal to the detection circuit 14, and input the remaining part of the signal to the PHY unit 11a. good. In this case, since an incomplete signal is input to the PHY section 11a, the conversion to the digital signal DS1 cannot be executed and an error occurs, or even if the PHY section 11a can convert it to the digital signal DS1, the processing device 12 An error will occur. That is, even if a part of the received signal RS1 is input to the PHY unit 11a in the first state, the processing device 12 does not perform regular control based on the part of the signal.

In the second state, the switch unit 13 outputs the reception signal RS1 received from the communication line 31 to the PHY unit 11a by electrically connecting the communication line 31 to the second port 13b. For example, in the second state, the switch unit 13 outputs the entire reception signal RS1 received from the communication line 31 (that is, in a complete state) to the PHY unit 11a. Here, the perfect state of the received signal RS1 means a state sufficient for normal conversion into the digital signal DS1 in the PHY section 11a. Therefore, even if a part of the received signal RS1 is missing when the received signal RS1 passes through the switch unit 13, if it can be converted normally into the digital signal DS1 in the PHY unit 11a, it is possible to ``state''.

The detection circuit 14 generates a detection value Vx according to the difference between the frequency of the first oscillation signal SG1 generated based on the oscillation of the first oscillator 18 and the frequency of the second oscillation signal SG2 included in the received signal RS1. This is a circuit that outputs to the control section 15. Details of the detection circuit 14 will be described later.

The control unit 15 determines unauthorized intrusion in the communication line 31 based on the detected value Vx, and controls the switch unit 13 according to the determination result. Specifically, the control unit 15 compares the detection value Vx input from the detection circuit 14 and the normal value V1 stored in the storage unit 16. For example, the absolute value of the difference between the detected value Vx and the normal value V1 (|Vx-V1|) is calculated. Then, if the absolute value exceeds the margin value α (|Vx−V1|>α), it is determined that there is unauthorized intrusion into the communication line 31.

When it is determined that unauthorized intrusion has occurred, the control unit 15 maintains the switch unit 13 in the first state to prevent the received signal RS1 in a perfect state from being input to the PHY unit 11a. If unauthorized intrusion is not determined, the control unit 15 inputs the received signal RS1 to the PHY unit 11a by switching the switch unit 13 from the first state to the second state. As a result, the received signal RS1 in a perfect state is input to the PHY unit 11a only when no unauthorized intrusion is detected, so it is possible to prevent an unauthorized received signal RS1 from being input to the PHY unit 11a. .

In addition, when all received signals RS1 are input to the detection circuit 14 in the first state, input to the PHY unit 11a is prevented while unauthorized intrusion is being determined, so the PHY unit 11a is put into a sleep state, etc. Since the power state can be maintained, power consumption of the on-vehicle device 10 can be suppressed.

The control unit 15 includes, for example, circuitry such as a processor. Specifically, the control unit 15 includes one or more CPUs (Central Processing Units). The processor included in the control unit 15 may be a GPU (Graphics Processing Unit). Further, the control unit 15 may be, for example, an SoC (System-on-a-Chip). The control unit 15 reads a computer program stored in the storage unit 16 and executes various calculations and controls.

The control unit 15 includes an oscillation circuit 41 that generates a first oscillation signal SG1 based on the oscillation of the first oscillator 18. The oscillation circuit 41 is a clock circuit for operating the control section 15. Note that the oscillation circuit 41 may be provided outside the control unit 15. In this case, the oscillation circuit 41 supplies the first oscillation signal SG1 to the control unit 15 from outside the control unit 15.

The storage unit 16 includes a volatile memory and a nonvolatile memory, and stores various data including a normal value V1 described below. Volatile memory includes, for example, RAM (Random Access Memory). Nonvolatile memory includes, for example, flash memory, HDD (Hard Disk Drive), SSD (Solid State Drive), ROM (Read Only Memory), and the like. The storage unit 16 stores computer programs and various parameters in, for example, nonvolatile memory.

The reading unit 17 reads information from a computer-readable recording medium 17a. The recording medium 17a is, for example, an optical disc such as a CD or DVD, or a USB flash memory. The reading unit 17 is, for example, an optical drive or a USB terminal. A computer program and various parameters are recorded on the recording medium 17a, and by causing the reading section 17 to read the recording medium 17a, the computer program and various parameters are stored in the nonvolatile memory of the storage section 16.

The first oscillator 18 is an element used as a clock source for each circuit included in the vehicle-mounted device 10. The first oscillator 18 is, for example, a crystal resonator. Note that the first oscillator 18 may be a ceramic resonator. In the example of FIG. 1, one first oscillator 18 is provided in the vehicle-mounted device 10, and an oscillation component is supplied from the first oscillator 18 to the oscillation circuit 41 in the control unit 15.

The temperature sensor 19 is a sensor that detects the temperature of the first oscillator 18. The temperature sensor 19 is, for example, a resistance temperature detector (RTD) such as a thermistor. Note that the temperature sensor 19 may be a thermocouple or an infrared radiation thermometer. Temperature sensor 19 outputs a detection signal to control section 15 .

[1.4 Configuration of detection circuit 14]
Next, the internal configuration of the detection circuit 14 will be explained. As shown in FIG. 3, the detection circuit 14 includes an extraction circuit 42, a first circuit 43, and a second circuit 44.

Here, the received signal RS1 is a signal in which the second oscillation signal SG2 (clock) and the data signal DS2 are superimposed in one differential signal. Thereby, both the second oscillation signal SG2 and the data signal DS2 can be transmitted through one type of communication line 30.

The extraction circuit 42 is a circuit that extracts the second oscillation signal SG2 from the received signal RS1 and outputs it to the first circuit 43. The extraction circuit 42 is, for example, a CDR (Clock Data Recovery) circuit.

The first oscillation signal SG1 is input from the oscillation circuit 41 to the first circuit 43, and the second oscillation signal SG2 is input from the extraction circuit 42. The first circuit 43 is a circuit that detects the difference between the frequency of the first oscillation signal SG1 and the frequency of the second oscillation signal SG2. The first circuit 43 is, for example, a PFD (Phase Frequency Detector) circuit. The difference detected by the first circuit 43 is output to the second circuit 44 as a pulse wave, for example.

The second circuit 44 is a circuit that converts the difference detected in the first circuit 43 into a detected value Vx. The second circuit 44 includes a CP (Charge Pump) circuit 45, a filter circuit 46, and an AD (Analog to Digital) conversion circuit 47. The difference detected in the first circuit 43 is input to the CP circuit 45.

The CP circuit 45 is a circuit that outputs a current signal (pulse current) according to the difference (pulse wave) detected in the first circuit 43, and includes, for example, a capacitor and a diode. The current signal output from the CP circuit 45 is input to a filter circuit 46.

The filter circuit 46 is a circuit that converts the current signal output from the CP circuit 45 into a voltage value. The filter circuit 46 is, for example, a lag lead filter, and converts the pulse current into a smoothed voltage value. The voltage value output from the filter circuit 46 is input to an AD conversion circuit 47.

The AD conversion circuit 47 is a circuit that converts the voltage value (analog value) output from the filter circuit 46 into a digital value. The AD conversion circuit 47 outputs the converted digital value to the control unit 15 as a detected value Vx. Note that the AD conversion circuit 47 may be provided inside the control section 15.

[1.5 Detection method]
Next, a method for detecting unauthorized intrusion in the in-vehicle system 1 will be explained.
4 and 5 are flowcharts illustrating the detection method according to the embodiment. 4 and 5 each show the control executed by the in-vehicle device 10.
FIG. 6 is a graph illustrating the detected value Vx according to the embodiment.

The in-vehicle system 1 first stores the normal value V1, and then detects unauthorized intrusion. FIG. 4 is a flowchart showing the procedure for storing the normal value V1, and FIG. 5 is a flowchart showing the procedure for detecting unauthorized intrusion. FIG. 6 is a graph showing the timing at which the procedures in FIGS. 4 and 5 are executed, where the vertical axis shows the detected value Vx and the horizontal axis shows time.

The storage of the normal value V1 is executed, for example, at the manufacturing factory of the vehicle 9 before the vehicle 9 is shipped, and is executed at time X1 in FIG. 6. Before the vehicle 9 is shipped (that is, inside the manufacturing factory), the risk of unauthorized intrusion into the in-vehicle system 1 is low, and therefore the normal value V1 can be registered in the storage unit 16 assuming that there is no unauthorized intrusion.

See FIG. 4. First, the switch section 13 is switched to the first state (the state shown by the solid line in FIG. 3) by a control command from the control section 15 (step S10). Thereby, the reception signal RS1 received from the communication line 31 is input to the detection circuit 14 via the switch section 13. In this example, all of the received signal RS1 is input to the detection circuit 14 in the first state, but as described above, part of the received signal RS1 may be input to the PHY section 11a.

Next, the first circuit 43 uses the frequency of the first oscillation signal SG1 generated based on the oscillation of the first oscillator 18 and the third oscillation signal generated based on the oscillation of the second oscillator 71 included in the ECU 21. The difference from the frequency of SG3 is detected (step S11). Specifically, the in-vehicle device 10 and the ECU 21 are operated, and, for example, a test signal in which the third oscillation signal SG3 and the data signal are superimposed is transmitted from the ECU 21 to the in-vehicle device 10 via the communication line 31. do. The in-vehicle device 10 receives the test signal as a reception signal RS1.

The received signal RS1 is input to the CDR circuit 42 via the first port 13a of the switch section 13. A third oscillation signal SG3 is extracted from the received signal RS1 in the CDR circuit 42, and the third oscillation signal SG3 is input to the first circuit 43 (PFD circuit). Further, the first oscillation signal SG1 generated in the oscillation circuit 41 based on the oscillation of the first oscillator 18 is also input to the first circuit 43. The first circuit 43 compares the frequency of the first oscillation signal SG1 and the frequency of the third oscillation signal SG3, and outputs the frequency difference to the second circuit 44 as a pulse wave. With the above steps, step S11 ends.

Subsequently, the second circuit 44 converts the frequency difference into a detected value Vx (from step S12 to step S14). Specifically, the CP circuit 45 converts the frequency difference into a current value (step S12), the filter circuit 46 converts the current value into a voltage value (step S13), and the AD conversion circuit 47 converts the voltage value into a digital value. (Step S14).

Finally, the control unit 15 causes the storage unit 16 to store the detected value Vx as the normal value V1 (step S15). Specifically, the AD conversion circuit 47 outputs the digital value to the control unit 15 as the detected value Vx. The control unit 15 causes the storage unit 16 to store the input detection value Vx as a normal value V1. With the above steps, step S15 ends.

Please refer to FIGS. 5 and 6. Detection of unauthorized intrusion is performed, for example, when the in-vehicle device 10 is powered on. Incidentally, detection of unauthorized intrusion may be performed periodically while the power of the in-vehicle device 10 is on, for example, or may be performed based on an operation by a passenger of the vehicle 9. In FIG. 6, detection of unauthorized intrusion is executed, for example, at time X2 and time X3 after the vehicle 9 is shipped.

In detecting unauthorized intrusion, first, the switch section 13 is switched to the first state by a control command from the control section 15 (step S20). Thereby, the reception signal RS1 received from the communication line 31 is input to the detection circuit 14 via the switch section 13.

Next, the first circuit 43 detects the difference between the frequency of the first oscillation signal SG1 and the frequency of the second oscillation signal SG2 included in the reception signal RS1 received from the communication line 31 (step S21).

Specifically, the in-vehicle device 10 receives the reception signal RS1 from the communication line 31. Here, at the time of step S21, the received signal RS1 is either a signal (regular signal) emitted from the ECU 21 as shown in FIG. 1, or a signal emitted from the unauthorized hub H1 as shown in FIG. (illegal signal) or unknown.

The received signal RS1 is input to the CDR circuit 42. A second oscillation signal SG2 is extracted from the received signal RS1 in the CDR circuit 42, and the second oscillation signal SG2 is input to the first circuit 43. Further, the first oscillation signal SG1 is also input to the first circuit 43. The first circuit 43 compares the frequency of the first oscillation signal SG1 and the frequency of the second oscillation signal SG2, and outputs the frequency difference to the second circuit 44 as a pulse wave. With the above steps, step S21 ends.

Subsequently, the second circuit 44 converts the frequency difference into a detected value Vx (from step S22 to step S24). Specifically, the CP circuit 45 converts the frequency difference into a current value (step S22), the filter circuit 46 converts the current value into a voltage value (step S23), and the AD conversion circuit 47 converts the voltage value into a digital value. (Step S24). The AD conversion circuit 47 outputs the digital value to the control unit 15 as a detected value Vx.

Next, the control unit 15 monitors whether the detected value Vx is within a predetermined range (step S25). Here, if the second oscillation signal SG2 included in the received signal RS1 is a signal based on the second oscillator 71 included in the ECU 21, the frequency of the second oscillation signal SG2 is within ±2 ppm of the frequency of the third oscillation signal SG3. are approximately equal within the range of . On the other hand, if the second oscillation signal SG2 is a signal based on the third oscillator H2 included in the hub H1, in most cases, the frequency of the second oscillation signal SG2 will be the same as that of the third oscillation signal SG3, unless they coincide by chance. The frequency differs from that of

In step S25, the detected value Vx (i.e., the value according to the difference between the first oscillation signal SG1 and the second oscillation signal SG2) is changed to the normal value V1 (i.e., the difference between the first oscillation signal SG1 and the third oscillation signal SG3). monitor how much it differs from the corresponding value). If the difference exceeds a predetermined value, it is considered that the second oscillation signal SG2 is not a signal caused by the second oscillator 71, and therefore, it is determined that unauthorized intrusion has occurred.

Specifically, the control unit 15 compares the input detection value Vx with the normal value V1 stored in the storage unit 16. For example, the control unit 15 calculates the absolute value of the difference between the detected value Vx and the normal value V1 (|Vx−V1|).

If the detected value Vx differs from the normal value V1 by more than a predetermined value (margin value α) (NO in step S25), the control unit 15 determines that there is an unauthorized intrusion into the communication line 31 (step S26). : Intrusion judgment). For example, the control unit 15 performs the intrusion determination when the absolute value of the difference between the detected value Vx and the normal value V1 exceeds the margin value α (|Vx−V1|>α).

Here, the margin value α is appropriately set according to the detection accuracy of unauthorized intrusion required of the in-vehicle device 10. The smaller the margin value α is set, the easier it is to detect unauthorized intrusion, but due to the effects of temperature, etc., which will be described later, the detected value Vx may fall below the margin value α from the normal value V1 even when there is no unauthorized intrusion. This increases the possibility of misjudgment. Furthermore, the larger the margin value α is set, the lower the possibility of misjudgment, but the easier it is to overlook unauthorized intrusion. The margin value α is set to a value of 2 ppm or less, for example.

When an intrusion determination is made, the control unit 15 prevents the reception signal RS1 from being input to the PHY unit 11a by maintaining the switch unit 13 in the first state. Further, the control unit 15 may cause a display unit (for example, a display), which is not shown, to display a message notifying that unauthorized intrusion has occurred. For example, the control unit 15 may display text such as “Unauthorized intrusion has been detected” on the display unit.

On the other hand, if the detected value Vx is within the predetermined value (margin value α) from the normal value V1 (YES in step S25), the control unit 15 does not perform the intrusion determination and switches the switch unit 13 to the second state (step S27). ). For example, the control unit 15 executes step S27 when the absolute value of the difference between the detected value Vx and the normal value V1 is less than or equal to the margin value α (|Vx−V1|≦α). Thereby, the PHY unit 11a receives the received signal RS1, and the PHY unit 11a converts the received signal RS1 into a digital signal DS1, so that the processing device 12 receives the digital signal DS1 (step S28).

After step S28, the processing device 12 executes various controls such as communicating with the ECU 21 based on the digital signal DS1. With the above steps, detection of unauthorized intrusion is completed.

In the example of FIG. 6, the detected value Vx becomes the value V1 at time X2 (Vx=V1). Since the detected value Vx is within the margin value α from the normal value V1, no unauthorized intrusion is detected at time X2. In this case, the control section 15 switches the switch section 13 from the first state to the second state.

On the other hand, at time X3, the detected value Vx becomes the value V2 (Vx=V2). Since the detected value Vx differs from the normal value V1 by more than the margin value α, unauthorized intrusion is detected at time X3. In this case, the control section 15 maintains the switch section 13 in the first state.

Although the unauthorized terminal D1 and the hub H1 can imitate the communication sequence of the ECU 21, they cannot imitate the third oscillation signal SG3 caused by the second oscillator 71 of the ECU 21. Therefore, by determining whether the frequency of the second oscillation signal SG2 received by the in-vehicle device 10 corresponds to the frequency of the third oscillation signal SG3 of the ECU 21, unauthorized intrusion can be detected more reliably. can.

Further, in the vehicle-mounted device 10, while unauthorized intrusion is being determined, the switch unit 13 is maintained in the first state so that the received signal RS1 is not input to the PHY unit 11a. Thereby, the received signal RS1 can be input to the PHY section 11a only when there is no unauthorized intrusion, so it is possible to prevent the unauthorized received signal RS1 from being input to the PHY section 11a.

Furthermore, while unauthorized intrusion is being determined, input of the received signal RS1 to the PHY unit 11a is prevented, so the PHY unit 11a can be kept in a power-saving state such as a sleep state, and the power of the on-vehicle device 10 is Consumption can be controlled.

Furthermore, since the detection circuit 14 and the control unit 15 provided outside the PHY unit 11a determine whether or not there is an unauthorized intrusion, a general-purpose PHY unit can be used as the PHY unit 11a. Therefore, there is no need to manufacture a dedicated PHY unit for determining unauthorized intrusion, and the manufacturing cost of the PHY unit can be reduced. In particular, since the vehicle-mounted device 10 is provided with a plurality of PHY sections, the manufacturing cost of the vehicle-mounted device 10 can be reduced by reducing the manufacturing cost of the PHY section.

[2. Modified example]
Modifications of the embodiment will be described below. In the modified example, the same components as those in the above embodiment are given the same reference numerals, and the description thereof will be omitted.

[2.1 Correction of normal values according to temperature characteristics]
FIG. 7 is a graph illustrating the temperature characteristics of the oscillator. The horizontal axis of FIG. 7 shows the temperature in degrees Celsius, and the vertical axis of FIG. 7 shows the frequency deviation (Δf/f) of the oscillator at each temperature, based on the frequency of the oscillator at 25 degrees Celsius.

As shown in FIG. 7, it is known that the frequency at which an oscillator such as a crystal resonator vibrates changes depending on the temperature. For example, as the temperature rises above 25 degrees Celsius, the oscillator frequency tends to slow down gradually, and then gradually speed up after passing through a minimum value. Further, when the temperature becomes lower than 25 degrees Celsius, the frequency of the oscillator tends to gradually increase, and after reaching a maximum value, gradually slow down.

For this reason, for example, when storing the above normal value V1 (steps S11 to S15) is performed in an environment of 25 degrees Celsius, detection of unauthorized intrusion (steps S21 to S25) is performed at 40 degrees Celsius (for example, When executed in a summer environment, the frequencies of the first oscillator 18 included in the vehicle-mounted device 10 and the second oscillator 71 included in the ECU 21 become slower than the respective frequencies when the normal value V1 is stored. The degree to which the frequency is slowed differs between the first oscillator 18 and the second oscillator 71.

Therefore, when detecting unauthorized intrusion at a temperature different from the temperature at which the normal value V1 was stored, if the margin value α is set smaller (for example, 0.5 ppm), the Despite the fact that the signal is a two-oscillation signal SG2 (that is, there is no unauthorized intrusion), the detected value Vx differs from the normal value V1 by more than the margin value α, so that the intrusion is determined (step S26). There is a risk that this may occur.

In order to prevent such misjudgment, the margin value α may be set large. However, if the margin value α is set to a large value, the detected value Vx corresponding to the second oscillation signal SG2 based on the oscillation of the third oscillator H2 of the unauthorized hub H1 coincidentally falls within the range of the margin value α with respect to the normal value V1. This increases the possibility that the unauthorized intrusion will be overlooked.

Therefore, in this modification, the normal value V1 is determined according to the temperature detected by a temperature sensor that detects the temperature of at least one of the first oscillator 18 and the second oscillator 71. This compensates for oscillator frequency deviations due to temperature changes.

Specifically, the temperature of the first oscillator 18 is detected by the temperature sensor 19 (FIG. 3). Since the in-vehicle system 1 is a system mounted on the vehicle 9, the temperature of the second oscillator 71 is considered to be approximately the same as the temperature detected by the temperature sensor 19. Therefore, in this modification, the temperature of the entire in-vehicle system 1 including the first oscillator 18 is detected by the temperature sensor 19. Note that different temperature sensors may be provided for the first oscillator 18 and the second oscillator 71, or a temperature sensor may be provided only near the second oscillator 71.

FIG. 8 is a table illustrating the relationship between normal values and temperature according to a modification. The table in FIG. 8 is stored in the storage unit 16. In FIG. 8, the first column of the table shows the temperature range, and the second column of the table shows normal values corresponding to the temperature range. The table in FIG. 8 is obtained, for example, by testing the in-vehicle system 1 under various temperature conditions before shipment.

For example, when the detected temperature Tx of the temperature sensor 19 is lower than the first temperature T1, the control unit 15 reads the normal value in the first row from the storage unit 16 and determines the normal value to be “V11”. Further, when the detected temperature Tx of the temperature sensor 19 exceeds the first temperature T1 and is below the second temperature T2, the control unit 15 reads the normal value on the second line from the storage unit 16, and sets the normal value as V11. is determined to be a different "V12". Then, when the detected temperature Tx of the temperature sensor 19 exceeds the second temperature T2 and is below the third temperature T3, the control unit 15 reads the normal value in the third row from the storage unit 16, and sets the normal value to V11 and "V13", which is different from V12, is determined.

In this way, the control unit 15 determines the normal value based on the table stored in the storage unit 16 and the detected temperature Tx. As a result, it is possible to compensate for the frequency deviation of the first oscillator 18 and the second oscillator 71 caused by temperature changes, and therefore it is possible to suppress false determinations even if the margin value α is set smaller, for example. can. As a result, it is possible to set a margin value α that is less likely to overlook unauthorized intrusion while suppressing erroneous determinations, so that unauthorized intrusion can be detected more reliably.

[2.2 Correction of normal values according to aging characteristics]
FIG. 9 is a graph illustrating the aging characteristics (aging characteristics) of the oscillator. The horizontal axis of FIG. 9 shows the number of elapsed days in a logarithmic manner, and the vertical axis of FIG. 9 shows the frequency deviation (Δf/f) of the oscillator at each point in time based on the oscillator frequency on the first day.

As shown in FIG. 9, it is known that the frequency at which an oscillator such as a crystal oscillator vibrates changes over time. FIG. 9 shows an example in which the frequency of the oscillator gradually decreases (the vibration gradually slows down) due to impurities attached to the oscillator over time. However, depending on the characteristics of the oscillator, for example due to age, the oscillator's frequency may gradually increase as gas is released from the oscillator, and after reaching a maximum value over a certain number of days, the frequency may gradually decrease. .

For this reason, for example, when storing the above normal value V1 (steps S11 to S15) is executed in an environment where the number of days elapsed is short (for example, 10 days), the detection of unauthorized intrusion (steps S21 to S25) is For example, when executed 1000 days later, the frequencies of the first oscillator 18 and the second oscillator 71 are different from the respective frequencies when the normal value V1 was stored, so even though there is no unauthorized access, First, there is a possibility that the detected value Vx differs from the normal value V1 by more than the margin value α, and an intrusion determination (step S26) will be made.

Therefore, in this modification, in order to take into account the aging characteristics of the first oscillator 18 and the second oscillator 71, the normal value V1 stored in the on-vehicle device 10 can be updated by the administrator's operation. This compensates for oscillator frequency deviations due to aging.

For example, the owner of the vehicle 9 brings the vehicle 9 to a business (for example, a dealer) that regularly performs vehicle inspections for inspection. The business operator is, for example, an administrator who has been granted management authority for the in-vehicle system 1 by the manufacturer of the in-vehicle system 1, and holds a key for overwriting the normal value V1. The key may be, for example, a key that is inserted into the vehicle-mounted device 10 using hardware, or a key that is input into the vehicle-mounted device 10 using software.

For example, the control unit 15 is capable of selecting a plurality of operation modes including a first mode and a second mode. In normal times, the second mode is selected as the operating mode of the control unit 15. When the second mode is selected, the control unit 15 cannot change the normal value V1 stored in the storage unit 16. Only when a key is input into the vehicle-mounted device 10 by the administrator, the control unit 15 can select the first mode.

When the first mode is selected, when the administrator instructs the control unit 15 to update the normal value V1 using an input unit (for example, a keyboard, not shown), the control unit 15 updates the normal value V1 shown in FIG. Execute the memory of. Then, the control unit 15 changes the normal value V1 stored in the storage unit 16 to the detection value Vx output from the detection circuit 14 while the first mode is selected.

For example, during the first year inspection of the vehicle 9 (time point X11 in FIG. 9), the administrator updates the normal value V1 to a new value. The manager also updates the normal values at the third-year inspection (time X12 in FIG. 9) and fifth-year inspection (time X13 in FIG. 9) of the vehicle 9, respectively. As a result, it is possible to compensate for the frequency deviation of the oscillator caused by secular changes, so as in the case of temperature compensation, it is possible to set the margin value α to a value that suppresses false judgments and has a low risk of overlooking unauthorized intrusion. can. As a result, unauthorized intrusion can be detected more reliably.

[2.3 Intentionally changing the oscillator temperature]
In the embodiment described above, unauthorized intrusion is detected by utilizing the fact that the second oscillator 71 included in the ECU 21 and the third oscillator H2 included in the unauthorized hub H1 are different in terms of hardware. However, if by chance the frequency of the second oscillator 71 and the frequency of the third oscillator H2 match, there is a possibility that unauthorized intrusion cannot be detected.

Therefore, in this modification, the temperature of the second oscillator 71 is intentionally changed, and if the detected value Vx after the temperature change differs by more than the margin value α from the normal value V4 for which temperature compensation has been performed, unauthorized intrusion is prevented. To detect.

FIG. 10 is a diagram showing the configuration of an in-vehicle system 1a according to a modification. The in-vehicle system 1a differs from the in-vehicle system 1 in FIG. It differs from Further, in this modification, the control section 15 controls the temperature adjustment section 72 by issuing a command signal to the temperature adjustment section 72.

The temperature adjustment section 72 is, for example, a heating section such as a resistance heater that can only perform heating. Note that the temperature adjustment unit 72 may be able to perform both heating and cooling. In this case, the temperature adjustment section 72 is, for example, a Peltier element.

FIG. 11 is a graph illustrating the detected value Vx according to the modified example. In this modification, the normal value is temperature compensated. For example, the normal value at 25 degrees Celsius is "V1", the normal value at the first predetermined temperature T4 higher than 25 degrees Celsius is "V4", and the normal value at the second predetermined temperature T5 higher than the first predetermined temperature T4 The normal value is determined to be "V5".

For example, consider a case where the detection environment is 25 degrees Celsius. First, in a state where the control unit 15 does not issue an instruction to the temperature adjustment unit 72 (that is, a state where the second oscillator 71 is at 25 degrees Celsius), the in-vehicle device 10 detects unauthorized intrusion. In this case, if the same value as the normal value V1 is detected as the detection value Vx, for example, no unauthorized intrusion is detected.

If no unauthorized intrusion is detected at 25 degrees Celsius, there is a possibility that the frequency of the second oscillator 71 and the frequency of the third oscillator H2 coincidentally match. Therefore, next, the control unit 15 instructs the temperature adjustment unit 72 to adjust the temperature of the second oscillator 71 to the first predetermined temperature T4. Then, at time X4 when the temperature of the second oscillator 71 reaches the first predetermined temperature T4, the in-vehicle device 10 detects unauthorized intrusion again.

Specifically, the detection circuit 14 uses the frequency of the first oscillation signal SG1 and the reception signal RS1 received while the second oscillator 71 is being adjusted to the first predetermined temperature T4 according to an instruction from the control unit 15. The first detected value Vx1, which is the detected value Vx corresponding to the difference between the frequency of the included second oscillation signal SG2, is output to the control unit 15.

Then, the control unit 15 generates a third oscillation signal generated based on the frequency of the first oscillation signal SG1 and the oscillation of the second oscillator 71 while the second oscillator 71 is adjusted to the first predetermined temperature T4. If the first detected value Vx1 differs by more than a predetermined value (margin value α) from the first normal value V4, which is a normal value corresponding to the difference between the frequency of SG3 and determine something.

For example, in the case of unauthorized intrusion, even if the temperature of the second oscillator 71 is adjusted to the first predetermined temperature T4 by the temperature adjustment unit 72, the temperature of the third oscillator H2 of the unauthorized hub H1 is not changed. The first detected value Vx1 becomes "V1". On the other hand, if there is no unauthorized intrusion, the first detected value Vx1 becomes "V4" as the temperature of the second oscillator 71 is adjusted. Therefore, in this modification, unauthorized intrusion is detected when the first detected value Vx1 does not follow the temperature adjustment by the temperature adjustment section 72, and when it follows the temperature adjustment by the temperature adjustment section 72, No intrusion detected. Thereby, even if the frequency of the second oscillator 71 and the frequency of the third oscillator H2 coincidentally match, unauthorized intrusion can be detected.

Further, at time X5 after the temperature adjustment unit 72 changes the temperature of the second oscillator 71 to a second predetermined temperature T5 higher than the first predetermined temperature T4, the in-vehicle device 10 detects unauthorized intrusion again. May be executed. By changing the temperature multiple times and detecting unauthorized intrusion each time, detection accuracy can be further improved.

Specifically, the detection circuit 14 uses the frequency of the first oscillation signal SG1 and the reception signal RS1 received while the second oscillator 71 is being adjusted to the second predetermined temperature T5 according to an instruction from the control unit 15. A second detected value Vx2, which is a detected value Vx corresponding to the difference between the frequency of the included second oscillation signal SG2, is output to the control unit 15.

Then, the control unit 15 generates a third oscillation signal generated based on the frequency of the first oscillation signal SG1 and the oscillation of the second oscillator 71 while the second oscillator 71 is adjusted to the second predetermined temperature T5. If the second detected value Vx2 differs by more than a predetermined value (margin value α) from the second normal value V5, which is a normal value corresponding to the difference between the frequency of SG3 and determine something.

Note that the first predetermined temperature T4 may be lower than 25 degrees Celsius, and the second predetermined temperature T5 may be lower than the first predetermined temperature T4.

[3. Addendum]
Note that at least some of the above embodiments and various modifications may be arbitrarily combined with each other. Furthermore, the embodiments and modifications disclosed herein are illustrative in all respects and should not be considered restrictive. The scope of the present disclosure is indicated by the claims, and it is intended that all changes within the meaning and range equivalent to the claims are included.

1 Vehicle-mounted system 1a Vehicle-mounted system 10 Vehicle-mounted device 11 PHY section 12 Processing device 13 Switch section 13a First port 13b Second port 14 Detection circuit 15 Control section 16 Storage section 17 Reading section 17a Recording medium 18 First oscillator 19 Temperature sensor 20 ECU
21 ECU
22 ECU
23 ECU
24 ECU
30 communication line 31 communication line 32 communication line 33 communication line 34 communication line 41 oscillation circuit 42 extraction circuit (CDR circuit)
43 First circuit (PFD circuit)
44 Second circuit 45 CP circuit 46 Filter circuit 47 AD conversion circuit 71 Second oscillator 72 Temperature adjustment section 73 Temperature sensor 9 Vehicle D1 Unauthorized terminal H1 Hub (repeater hub)
H2 oscillator (third oscillator)
B1 Bus RS1 Received signal SG1 First oscillation signal SG2 Second oscillation signal SG3 Oscillation signal (third oscillation signal)
SGx Oscillation signal DS1 Digital signal DS2 Data signal Vx Detected value Vx1 Detected value (first detected value)
Vx2 detection value (second detection value)
V1 Normal value V4 Normal value (first normal value)
V5 normal value (second normal value)
α Margin value X1 Time X2 Time X3 Time X4 Time X5 Time X11 Time X12 Time X13 Time T1 First temperature T2 Second temperature T3 Third temperature T4 First predetermined temperature T5 Second predetermined temperature Tx Detected temperature

Claims (9)

An in-vehicle device connected to an ECU installed in a vehicle through a communication line,
a PHY unit that converts a received signal received from the communication line into a digital signal;
an oscillation circuit that outputs a first oscillation signal based on the oscillation of the first oscillator;
a detection circuit that outputs a detected value according to a difference between the frequency of the first oscillation signal and the frequency of a second oscillation signal included in the received signal;
a switch unit that switches between a first state in which at least some of the received signals are not input to the PHY unit and a second state in which the received signals are input to the PHY unit;
a control section that controls the switch section;
Equipped with
The control unit includes:
The detected value exceeds a predetermined value from a normal value according to a difference between the frequency of the first oscillation signal and the frequency of a third oscillation signal generated based on oscillation of a second oscillator included in the ECU. and when they are different, the switch section is set to the first state,
When the detected value is within the predetermined value from the normal value, the switch section is placed in the second state;
In-vehicle device. The detection circuit includes:
a first circuit into which the first oscillation signal and the second oscillation signal are input and detects a difference between the frequency of the first oscillation signal and the frequency of the second oscillation signal;
a second circuit that converts the difference detected in the first circuit into the detected value;
including,
The in-vehicle device according to claim 1. The received signal is a signal in which the second oscillation signal and the data signal are superimposed,
The detection circuit further includes an extraction circuit that extracts the second oscillation signal from the received signal and outputs it to the first circuit.
The in-vehicle device according to claim 2. further comprising a storage unit in which the normal value is stored in advance;
The vehicle-mounted device according to any one of claims 1 to 3. The control unit is capable of selecting a plurality of operation modes including a first mode and a second mode,
When the first mode is selected, the control unit converts the normal value stored in the storage unit into the detected value output from the detection circuit while the first mode is selected. Change it to
When the second mode is selected, the control unit does not change the normal value stored in the storage unit.
The in-vehicle device according to claim 4. The control unit determines the normal value based on a temperature detected by a temperature sensor that detects the temperature of at least one of the first oscillator and the second oscillator.
The in-vehicle device according to claim 4. The control unit controls a temperature adjustment unit that adjusts the temperature of the second oscillator,
The detection circuit detects the frequency of the first oscillation signal and the second oscillation signal included in the reception signal received while the second oscillator is being adjusted to a first predetermined temperature by the temperature adjustment section. outputting a first detection value, which is the detection value according to the difference between the frequency and the frequency, to the control unit;
The control unit is configured to determine whether the first detected value is the frequency of the first oscillation signal and the temperature of the second oscillator while the temperature adjustment unit is adjusting the second oscillator to the first predetermined temperature. When the frequency of the third oscillation signal generated based on oscillation differs from the first normal value, which is the normal value according to the difference, by more than a predetermined value, the switch section is set to the first state. and
The vehicle-mounted device according to any one of claims 1 to 3. A control method for controlling an in-vehicle device connected to an ECU installed in a vehicle through a communication line, the control method comprising:
A first step of setting a first state in which at least part of the received signals received from the communication line is not input to the PHY unit when the detected value differs from the normal value by more than a predetermined value;
a second step of entering a second state in which the received signal is input to the PHY unit when the detected value is within the predetermined value from the normal value;
Equipped with
The PHY unit converts the received signal into a digital signal,
The detected value is based on the difference between the frequency of a first oscillation signal output by an oscillation circuit included in the in-vehicle device based on oscillation of a first oscillator and the frequency of a second oscillation signal included in the received signal. is the value
The normal value is a value corresponding to a difference between the frequency of the first oscillation signal and the frequency of a third oscillation signal generated based on oscillation of a second oscillator included in the ECU.
Control method. A computer program for controlling an in-vehicle device connected to an ECU installed in a vehicle through a communication line,
A computer program is a computer program that
A first step of setting a first state in which at least part of the received signals received from the communication line is not input to the PHY unit when the detected value differs from the normal value by more than a predetermined value;
a second step of entering a second state in which the received signal is input to the PHY unit when the detected value is within the predetermined value from the normal value;
run the
The PHY unit converts the received signal into a digital signal,
The detected value is based on the difference between the frequency of a first oscillation signal output by an oscillation circuit included in the in-vehicle device based on oscillation of a first oscillator and the frequency of a second oscillation signal included in the received signal. is the value
The normal value is a value corresponding to a difference between the frequency of the first oscillation signal and the frequency of a third oscillation signal generated based on oscillation of a second oscillator included in the ECU.
computer program.

Images